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O ' 

f"^ ■ We present security proofs for a protocol for Quantum Key Distribution (QKD) based on encoding 

£SJ ' in finite high-dimensional Hilbert spaces. This protocol is an extension of Bennett's and Brassard's 

basic protocol from two bases, two state encoding to a multi bases, multi state encoding. We 
analyze the mutual information between the legitimate parties and the eavesdropper, and the error 
rate, as function of the dimension of the Hilbert space, while considering optimal incoherent and 
coherent eavesdropping attacks. We obtain the upper limit for the legitimate party error rate to 
ensure unconditional security when the eavesdropper uses incoherent and coherent eavesdropping 
strategies. We have also consider realistic noise caused by detector's noise. 

> ' I. INTRODUCTION 

G\ ' 

Quantum cryptography aims to provide an unconditionally secure key distribution between two parties, Alice and 
Bob. In the first protocol proposed by Bennett and Brassard (BB84) [0, to detect eavesdropping, Alice and Bob 
choose randomly between two complementary (conjugate) bases and in each basis the "information" is encoded using 
t-H ■ two orthogonal quantum states (qubits). Since the basis is unknown to the eavesdropper (by convention called Eve), 
she cannot simply copy the sent states because the non-cloning theorem. The use of random complementary bases 
"p^ , furthermore implies that if the sender Alice prepares a state in one basis, the outcome of a measurement by Bob or 
O ,' Eve in a complementary basis will yield a totally random measurement outcome. These features guarantee that any 
eavesdropping attempt will invariably introduce errors in the transmission, which can be detected by the legitimate 
communicating parties. An extension to the BB84 protocol was made by Brufi [0 and by Bechmann-Pasquinucci and 
Gisin H to a six-state, three complementary bases protocol. The analysis shows that Eve's information gain for a 
^ given impaired error rate is lower than in the BB84 protocol |^||. Very recently two other extensions were proposed 
where the authors have considered schemes using four states and two bases Q , and three states and four bases || . In 
an earlier work we have generalized these results to encoding in A^-dimensional Hilbert space using M < N + 1 bases 
H where we have considered some specific and rather simple, but realistic, eavesdropping attacks. The goal of this 
work is to find an ultimate and practical condition for the security of quantum key distribution protocols, sufficiently 
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general to encompass all possible types of eavesdropping. The condition we derive is given in the form of a theorem. 
We will also derive the upper permissible limit for Bob's error rate to ensure unconditional security when Eve uses 
incoherent and coherent eavesdropping attacks. 

The paper is organized as follows: In Sec. 2, we give a brief introduction to our protocol. In Sec. 3 we reiterate 
the secrecy capacity of a channel and derive the results for an intercept-resend eavesdropping attack. In Sees. 4 and 
5, we study optimal individual eavesdropping attacks, and coherent eavesdropping attacks, respectively. In Sec. 6 we 
consider realistic systems where we assume that the detector dark count probability is not negligible. Finally, in Sec. 
7 we present our conclusions. 
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II. A MULTI BASES MULTI STATE QUANTUM KEY DISTRIBUTION PROTOCOL 



In the BB84 protocol pj], Alice first randomly chooses between one of two bases to prepare her state, and secondly 
she randomly decides which of two orthogonal states in the chosen basis to send. Extending this protocol to a TV- 
dimensional Hilbert space TCn, Alice first chooses from which of M complementary bases to choose her state from, 
and secondly she decides which of the N orthogonal states defining the basis to send. The "information" encoded 
by the chosen state will from hereon be denoted quNits. Each symbol sent in the M bases and ./V quNits are chosen 
randomly with equal probability i.e. each of the possible NM states appear with probability 1/(MN). We first 
define the bases {iPa} and {4>b} over an TV-dimensional space to be mutually complementary if the inner products 
between all possible pairs of vectors, with one state from each basis, have the same magnitude: 

\ a (^\iP 3 )b\ = 1/Vn V (1) 

If a quantum state is prepared in the {iPa} basis, but measured in the complementary {V'b} basis, the outcome is 
completely random. Wootters and Fields have shown Q that when N = p k , where p is a prime and k a positive 
integer, which we restrict ourselves to here, then there exist a set of M = N + 1 mutually complementary bases Q|. 

To estimate the mutual information between Alice and Bob, Alice and Eve, and the information gain of the 
eavesdropper Eve, the relevant information measure is the Shannon information of the sifted symbols, i.e., the symbols 
for which Alice and Bob have used the same bases. For simplicity, we choose to measure this information in bits. From 
the receiver's (Bob's or Eve's) point of view, there will be an a priori p(x) and an a posteriori p(x\y) probability, the 
latter being the conditional probability of the sending party (Alice) having sent the symbol x, given that the receiver 
(Eve or Bob) measured the result y. The receiver's mean information gain from Alice's symbol, /^y, where Y = B, E 
denote either Bob or Eve, equals his or her entropy decrease: 

T N _ TfN ttN fr,\ 

1 AY- n a pri n apost \ z ) 

The a priori probability for Alice's symbol is uniform (since the protocol dictates that Alice must chose the symbols 
she sends randomly), leading to ^^ r j = log(iV). The a posteriori entropy is defined: 

Kpost = E^w) E^iy) iog(p(^iy)), (3) 

V x 

where the a posteriori probability of symbol y given observer's result x is given by Bayes' theorem: 
with p(y) = T, x P(y\ x )P( x )- 

The mutual information between Bob and Alice as function of Bob's error rate is obtained by using Eq. @ and by 
using the symmetry properties of the protocol, i.e., that Bob's measurement errors are independent of, and uniform 
for, all symbols sent by Alice: 

P N 

Iab(4) = log(AT) + (1 - eg) log(l - e N B ) + e N B M^), (5) 

where e B is Bob's error rate, i.e., the probability that he measures a symbol erroneously. Note that since expressions 
(^ ) and (^|) refer to the information and errors contained in the sifted symbols, these errors are due to a possible 
eavesdropping disturbance and system noise such as the dark counts of the detectors, the tranmission loss, etc. They 
are not due to Bob's random choice of measurement basis. 



III. EAVESDROPPING 



In an ideal system, after the quNit string has been transmitted, measured, and sifted, Alice and Bob will share 
a common key. However, in real systems there are always some errors, and some of these errors may be due to an 
eavesdropper. Hence, Alice and Bob need to use error correction through a classical channel to establish an identical 
key, and privacy amplification to obtain a secret common key |^|,^| . The eavesdropping attacks by Eve must introduce 
errors. As stated above this is due to Alice's random choice of measurement basis and the fact that Eve cannot 
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copy an unknown state perfectly. In the case of simple intercept-resend eavesdropping attacks, Eve gets one of the 
NM possible results. After Alice and Bob announced their choice of bases we have p(x = y\{ipA} — {4>e}) = 1, 
p( x 7^ 2/KVm.} = {^-e}) = 0, and p(y\{ipA} {^e}) — 1/N V x, y. Therefore, according to (0) and (||), Eve's 
information gain is Iae = \og{N)/M and Bob's error rate becomes e B = (1 — 1/M)(1 — 1/N) when Eve employs the 
intercept-resend eavesdropping strategy. 

Csiszar and Korner |flo|| have given a lower bound for the secrecy capacity, that is, the maximum rate at which Alice 
can reliably send random symbols to Bob such that the rate at which Eve obtain information about the symbols is 
arbitrarily small. We can give their result as a theorem, the proof of the theorem is given in |ic|| . 

Theorem 1: Alice and Bob can establish a secret key (using error correction and privacy amplification) if, and 
only if, I% B > Ij[ E or > I BB i where Iabi Iae ana ^ I be are * ne mutual information between Alice and Bob, Alice 
and Eve, and Bob and Eve, respectively. 

Taking the sifting, error correction, and privacy amplification into account, we can hence define an effective trans- 
mission rate as 

R N A B {e N B ) = ^{lI B {e N B )-lUe N B ))- (6) 

We will discuss in the following sections the different eavesdropping strategies and present a security analysis. First 
we begin by considering individual attacks where Eve attaches independent probes to each quNit and measures her 
probes one after the other. Second, we consider coherent attacks in which Eve process several quNits jointly. 



IV. INDIVIDUAL EAVESDROPPING ATTACKS: UNIVERSAL QUANTUM CLONING MACHINE 

Here we discuss an individual eavesdropping strategy based on the use of an asymmetric version of the N-dimensional 
symmetric Universal Quantum Cloning Machine (UQCM) introduced by Buzek and Hillery [O. This asymmetric 
doner (lJ|R| can be used to obtain two copies of Alice's quantum state that are not of the same fidelity. Eve then 
keeps one of the copies (typically, the bad one) for herself, and passes the other copy (typically, the good one) to 
Bob. Then, after Bob and Alice have announced their chosen bases, Eve does the same measurement as Bob did, 
i.e., she measures her copy in the same basis as Alice and Bob. Therefore, on the average, she will obtain similar 
information as Bob. The asymmetry parameter of the doner allows her to adjust the amout of information she gained, 
and thereby the amount of information Bob lost. The asymmetric doner is universal, just as the UQCM so that 
all input states are copied equally well (Bob's fidelity and Eve's fidelity do not depend on Alice's chosen state nor 
chosen basis) . Note that the quantum circuit that implements this asymmetric doner is exhibited in Ref . |l4[ . 

It should be stressed that, if Eve makes use of such an asymmetric UQCM for eavesdropping, she should exploit the 
state of her copy but also that of the cloning machine (or ancilla) in order to extract a maximum of information on 
Alice's quantum state. In particular, she can make a coherent measurement on the state of the cloning machine and her 
copy in order to infer whether she introduced an error at Bob's station (and precisely what error) j3j. For increasing 
disturbance, the fidelity F^ B between the sent state and the state inferred by Bob (defined on the sifted symbols) 
that govern the probability that he and Alice will accept the transmitted state decreases, while Eve's probability of 
correctly guessing the symbol increases. 

Let us analyze the situation when Eve uses a A^-dimensional copying machine such as described in Re. J^],^. If 
Alice sends the state \tpk), the output state is given by: 

JV-l 

\lpk)A — > a m . n U m . n \lp k ) b\® 'rn,N -n) EM (?) 

m,n— 

where the amplitudes a mi „ (with m, n = 0, • • • , N — 1) characterize the doner and A, B, E and M stand for Alice, 
Bob, Eve and the cloning machine respectively. Here, the states \^ m ,n)EM are the generalization the Bell states, that 
is, a set of N 2 orthonormal maximally- entangled states of two A^-dimensional systems: 

i k- 1 

\* m , n ) EM = -t= ]T e 2 ^ ln >^\^) E \^ +m )M (8) 

^ 1=0 

where the indices m and n (m, n = 0, • • • , N — 1) label the N 2 states. Note that, here and below, the ket labels are 
taken modulo N. The operators U„ ltn , defined as 
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JV-1 



U m , n =J2 e2Mkn/N) \^ +m )(A\ (9) 

k=0 

form a group of error operators on iV-dimensional states, generalizing the Pauli matrices for qubits: m labels the 
"shift" errors (generalizing the bit flip a x ) while n labels the phase errors (generalizing the phase flip a z ). Using the 
definition of the states |*m,n) and operators U m ,n, Eq. (J?]) can be reexpressed as 

^ JV-l N-l 

\lpk)A -* —7= Y \i>k+ m )B Y c ™.fe-' \^l)E \">Pl+m)M (10) 

V m=0 ;=0 

where 

iV-l 



£ « m /' (WW1 (11) 



71=0 

which will be used in the following. Tracing the output joint state as given by Eq. over E and M, it is easy to 
check that Alice's state \i/>k)A gets transformed, at Bob's station, into the mixture 

N-l 

PB = Y \ a m,n\ 2 \iJk+m)(4>k+m\ (12) 
m,n— 

Thus, the state undergoes a U m . 

n error with probability Pm,n — |^m,«J (with n Pm,n — 

1). Note that U ,o = 1, 

implying that the state is left unchanged with probability po,o- The phase errors (n ^ 0) clearly do not play any role 
in the above mixture, so the fidelity for Bob can be expressed as 

N-l 

f b = {MpBHk) = I a °.«l 2 ( 13 ) 

71=0 

Now, we will impose that the doner descibed above is universal, that is ]l2] , |T3| 



a m ,n = a5 m . S nfi + — (14) 



with the normalisation relation 

a 2 + ^a(3 + f3 2 = 1. (15) 

where the balance a vs (3 parametrizes the asymmetry of the doner (a = 1 and f3 = correspond to the case where 
Bob gets all the information, whereas a = and j3 = 1 correspond to Eve getting all the information). This implies 
that 

c m j = a £ TO)0 + 8jfi (16) 
so that we obtain for the cloning transformation 

N-i / N-l \ 

k+m/M 

V N m=Q V i=0 / 

+ Y \^k+m)B {-j=\^k} E \^k+ m )Mj (17) 



where the first term in the r. h. s. corresponds to Bob having no error, while the (N — 1) other terms correspond to 
all possible errors for Bob. 
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Eve' strategy is as follows. She first measure both her copy E and the "cloning machine" M in the good basis (after 
the chosen basis is disclosed by Alice and Bob). If the two outcomes coincide, then she knows for sure that Bob has 
no error (m = 0), so that the state she has is the first term in the r. h. s. of Eq. (|l7|). Otherwise, she knows Bob had 
an error (m > 0), and she gets one of the other terms in the r. h. s. of Eq. ([17]). Let us consider these two cases: 
(i) m = 0. The joint probability that Eve obtains m = and the right value of k is 



p m=0 {k) = 



N 



(18) 



while the probability that she obtains m = with any other of the (N — 1) possibilities I ^ k is 



Pm=o(0 = 



(19) 



(ii) m 7^ 0. Then, a measurement of her copy gives Eve the right value of k with certainty. Thus, the joint probability 
that Eve obtains any of the N — 1 values of to 7^ together with the good k is 



p m ^o(k) 



N 



(20) 



The fidelity of Bob is given by 



Fb = Pm=o(k) + y^Pm=o(Q 

l^k 

V ' N 



1 



N 

N - 



1 



N 



-O 2 



(21) 



The corresponding mutual information between Alice and Bob is given by 

l-F B 1-iV 



I[A\B) = log(iV) - H 



F R 



N-l N-l 
log(iV) + Fb log [F B ] + (1 - F B ) log 



1-F B 



N - 1 



(22) 



Consider now the mutual information between Alice and Eve. Conditionally on Eve's measured value of m (i.e., 
conditionally on Bob's error), this information can be expressed as 



I(A:E\m = 0) = log(A) - H 
I(A:E\m ^ 0) = log(JV) 



(q + I3f a 2 a 2 
NF B ' NFb'"' 1 NF b 



(23) 



Thus, the average mutual information between Alice and Eve is 

I(A:E) = F B I{A:E\m = 0) + (1 - F B )I{A:E\m ^ 0) 



log(JV) — Fb H 



(a + (3) 2 a 2 
NF B ' NF B 



log(JV) 



N 



log 



(a + P) 2 



NF B 



NF b 
N-l 



N 



-a log 



a 



NFn 



This information can also be reexpressed, using Eve's fidelity, 



F E = 1- 



N — 1 



N 



(24) 



(25) 



I{A:E) = log(iV) -F B H 



Fb + Fe — 1 1 — Fe 



F b 



log(iV) + (F B + F e -1) log 



{N~1)F B 
Fb + Fe-1 



F b 



1-F e 
(N - 1)F B 

(l-J^)Iog 



1-i^E 



L(iV-l)F fl 



(26) 
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As shown in (TTJ the maximal fidelity of copying a quNit is obtained using the UQCM. This maximal value of the 
fidelity correspond precisely to the fidelity of optimal incoherent eavesdropping strategy, as Bechmann-Pasquinucci 
and Gisin have shown explicitly for the (N = 2, M — 3) case ||. From the symmetry of the problem it follows that 
for M = N + 1, the fidelity of the optimal incoherent eavesdropping is accomplished using a UQCM. 

In Fig. [l], we plot the information rate R^ B , defined by Eq. ([|), as a function of Bob's error rate for different 
values of N. For each N, the intersection between the graphs R^b an d the horizontal axis correspond to the upper 
permissible bound for Bob's error rate to enable secure key distribution. In all cases, the UQCM gives the best 
performance (from the viewpoint of the eavesdropper) so Alice and Bob should use the UQCM model to estimate the 
"leakage" of information to Eve when applying privacy amplification. 



V. COHERENT EAVESDROPPING ATTACKS 



In the previous section we have assumed only individual attacks, i.e., that Eve manipulates and performs measure- 
ments on each quNit separately. In this section we address the question: If Eve manipulates several quNits coherently, 
means an arbitrary large but finite number of quNits. We like to stress that the length of key must be much longer 
than this number. What is the maximum rate of errors detected by Bob that allows Alice and Bob to still apply 
error correction and priv acy amplification to extract a secure key? Already in 1996, Mayers presented ideas on how 
to prove this bound fil| . Now several proofs exist . Here we shall present the proof in form quite different 

from the previous ones. We present our result in the form of a theorem: 

Theorem 2: In A-dimensional Hilbert space, two users Alice and Bob can establish a secret key if, and only if, 
Bob's error rate satisfy the inequality: 

p n 1 

(1 - e N B ) log(l - e N B ) + e N B Mjyfy) <-- log(iV), (27) 

where e B is Bob's error rate. 

To prove this theorem we need another theorem due to Hall [51| that sets a limit on the sum of the mutual infor- 
mation between Alice and Bob and the mutual information between Alice and Eve: 



Theorem 3: 

Let B and E be symbol observables for Bob and Eve, respectively, in a A^-dimensional Hilbert space such that the 
maximum possible overlap between any two eigenvectors | ipi ) B and \tpj)E corresponding to these observables is 
C = MaXij{|s( V'i I V'j )e\}- Then the mutual information Alice-Bob and Alice-Eve satisfy the following inequality: 

^ B + ^ E <21og 2 (7VC). (28) 

Now we are ready to prove Theorem 2. 



Proof of Theorem 2: Suppose Alice sent a large number of quNit symbols, and that Bob performed this measurement 
on n quNits of them using the correct basis. The Hilbert space dimension of the total sifted symbol space is thus 
N n . Let us now re-label the bases for each of the n quNits such that, by definition, Alice used all n times the {4>b} 
basis. Hence, using this re-labeling, Bob's observable is the n-time tensor product B\ ® ... ® B n . Since Eve had 
no way to know the correct bases, her optimal information on the correct ones is precisely the same as her optimal 
information on the incorrect ones. Hence, one can bound her information assuming she measures E\ ® ... ® E n where 
Ei is a complementary observable to B{. It follows that C = N~ n / 2 . By applying Theorem 3, we obtain the following 
inequality: 

lAB + I%E<nlog 2 (N) (29) 
By using the inequality I^ B > I^ E of Theorem 1 and Eq. ( ]29| ) and we obtain: 

^B<flog 2 (iV). (30) 

For string of n symbols, the mutual information between Alice and Bob becomes 

IIb^b) = <\og{N) + (1 - e N B ) log(l - e N B ) + e N B log(-^-)). (31) 
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Using the Eqs. © and @, we obtain Theorem 2. 

In Fig. |^, we plot the upper bound for the Bob's error rate as function of N in the case of the optimal incoherent 
and coherent eavesdropping attacks. For TV = 2 we recover the results for coherent attacks the result by Mayers 
HH e| = 11%. 



VI. REALISTIC SYSTEMS 



The attacks presented in the previous sections assume perfect eavesdropping and measurement apparata, and a 
noise-free channel. In real secret key distribution systems there are several limitations: The sources can emit more 
than one photon, some photons never get to Bob's detector (channel loss), the detector quantum efficiency is limited, 
and the dark count probability (counts not produced by photons) of the detectors is not negligible. We therefore 
define an experimental Quantum Bit Error Rate (QBER) for a iV-dimensional Hilbert space where we assume that 
the optical noise remains negligible even for large N and the only source of noise is the dark count of the detectors. 
Under these assumptions the QBER is given by: 

r\ o t~) Pincorrect Pincorrect /ooA 

QBLR = — — «— , (32) 

r incorrect i x correct r correct 

where 

Pcorrect = [ir]De^ aL — . (33) 

In Eq. (|33|), fj, is the average photon number per symbol, r\ is the detector quantum efficiency, a is the channel 
attenuation coefficient, L is the transmission length and qbasis = 1/M is a factor which depends inversely on the 
number of bases used in the protocol . The probability of incorrect counts, when we assume that all incorrect counts 
come from the detectors and they have the same dark count probability, is given by: 

Pincorrect ~ Pdark(N (*^) 

where Pdark is the probability of dark counts by detector. The QBER becomes 

QBER k Pd ^ N ~ l \ (35) 

In Fig. H we plot the information rate Rab as function of the transmission distance. The intersection of the two 
curves gives the maximal distance allowed between Alice and Bob such they can establish a secret key with typical 
parameter values i]o = 20 %, a = 0.2 dB/km, /.i = 0.1 and Pdark — 10~ 5 . 



VII. DISCUSSION AND CONCLUSIONS 



In this work we have considered an extension of Bennett's and Brassard's seminal quantum key distribution protocol 
into a iV-dimensional Hilbert space. We have obtained bounds on Bob's permissible error rate in the case of individual 
and coherent eavesdropping attacks, and we have give the limits for the transmission distances in non-ideal systems. 
Using similar arguments and methods one could also generalize Ekert's quantum cryptographic protocol p0[ , based 
on quantum entanglement and the test of Bell inequality to detect the eavesdropping, to a ./V-dimensional Hilbert 
space. Recently Kaszlilowski et al. have shown |2l]] that the violation of local realism by two entangled quNits is 
stronger than the violation for two entangled qubits. We conjecture that this would also imply a higher degree of 
security in entanglement-based multi-level quantum cryptography. 
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FIG. 1. The information rate Rab, defined by Eq. as a function of Bob's error rate eg for different Hilbert space 

dimensions N, assuming that M = N + 1, using the Universal Quantum Cloning Machine eavesdropping strategy. 



FIG. 2. Bob's error rate e B as a function of the dimension of Hilbert space iV for optimal incoherent and coherent eaves- 
dropping strategies. 

FIG. 3. The information rate Rab, defined by Eq. (^), as a function of the transmission distance L [the distance L is related 
to the quantum bit error rate by Eq. (53)]. Curves are plotted for different dimensions of the Hilbert space N, assuming that 
M = N + 1 and that the Universal Cloning Machine eavesdropping strategy is used. 
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